Infra

What is “allowed from”? The public IP address their connection arrives from — not their wifi name and not a 192.168 address. Ask them to run curl ifconfig.me and send you the result. Home addresses often change, so pin a range like 84.54.90.* rather than one address. Leave blank to use the office default. You can widen it later from the table above, and Access shows where each account has actually connected from.

Runners are defined once, on the Runners page, then added to whichever hosts they'll actually run jobs on — same identity, same key, same audit trail everywhere. Defining a new runner happens there, not here.

Name is just a label — it's what shows up everywhere in the UI and in logs, so make it recognisable (GitLab shows a short token in its runner list; put that here too). Username is the actual Linux account name this runner gets on every host it's added to — must be a valid username, shared across hosts. Defining a runner here does not create any account anywhere yet; add it to a host from that host's Accounts page.

Leave the key blank unless you have a specific reason not to. A runner authenticates with a short-lived certificate signed by the Vault SSH CA, and sshd validates that against its trusted CA — it never reads the account's authorized_keys at all. A key registered here gets planted on every host this runner is later added to, never expires, and carries no forced command — a permanently weaker way in, sitting next to the locked-down one.

PostgreSQL enforces the deadline itself, with VALID UNTIL — the credential stops working whether or not anything cleans up afterwards. The database is never exposed to issue it; the statement runs inside its own container.